CVE-2023-28201

This issue was addressed with improved state management

Critical · published May 8, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
67.3
In the wild
Unconfirmed
What it is

🚨 A remote user can cause chaos with just a crafted request — we're talking unexpected app crashes and potentially running any code the attacker wants! 🔥 Imagine your favorite coffee shop suddenly deciding to close early because a rogue customer complains about the service. This vulnerability is like that — a remote user could send a simple request that disrupts entire app operations, leading to a crash or worse. If exploited, this vulnerability could lead to arbitrary code execution, meaning an attacker might take complete control of your device or app. The result? A total disruption of your workflow and a potential security nightmare!

Put simply

Imagine your favorite coffee shop suddenly deciding to close early because a rogue customer complains about the service. This vulnerability is like that — a remote user could send a simple request that disrupts entire app operations, leading to a crash or worse. This vulnerability arises from insufficient state management within macOS and iOS applications, allowing attackers to exploit it remotely and execute arbitrary code or cause app termination.

What to do

If exploited, this vulnerability could lead to arbitrary code execution, meaning an attacker might take complete control of your device or app. The result? A total disruption of your workflow and a potential security nightmare! To protect yourself, ensure you're on the latest versions: update to macOS Ventura 13.3, Safari 16.4, iOS 16.4, or iPadOS 16.4 immediately. If you're still on older versions like iOS 15.7.4 or iPadOS 15.7.4, make the jump as well! ⚡ You've got this! Stay secure and keep your devices updated! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01174 · 67.3th percentile
Published
2023-05-08T00:00Z
EPSS history
Timeline
  • 08 MAY 00:00Z
    This issue was addressed with improved state management
    cvelistv5